--- /dev/null
+#!/bin/sh
+. "$(dirname "$0")/_lib.sh"
+
+# constants we might want to change at some point
+PATH_GIT_BASE=/srv/git
+
+# constants derived from changeables
+PATH_GIT_DAEMON_UNIT=/etc/systemd/system/git-daemon.service
+PATH_GIT_MIRROR="${PATH_GIT_BASE}/${NAME_REPO_DIR}.git"
+
+[ -e "${PATH_GIT_MIRROR}" ]\
+ && error "${PATH_GIT_MIRROR} already exists"
+
+msg 'Installing git …'
+apt-get -y update
+apt-get -y install git
+
+msg 'Bare-cloning repo to %s for anonymous serving …' "${PATH_GIT_MIRROR}"
+mkdir -p "${PATH_GIT_BASE}"
+git clone --quiet --bare "${PATH_REPO}" "${PATH_GIT_MIRROR}"
+touch "${PATH_GIT_MIRROR}/git-daemon-export-ok"
+
+msg 'Own repo to %s so they can update it via ssh …' "${USERNAME}"
+chown -R "${USERNAME}:${USERNAME}" "${PATH_GIT_MIRROR}"
+
+msg 'Writing and enabling git-daemon systemd unit …'
+cat <<EOF >| "${PATH_GIT_DAEMON_UNIT}"
+[Unit]
+Description=Anonymous read-only git daemon
+After=network.target
+
+[Service]
+User=${USERNAME}
+ExecStart=/usr/bin/git daemon --reuseaddr \
+ --base-path=${PATH_GIT_BASE} ${PATH_GIT_BASE}
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl daemon-reload
+systemctl enable --now git-daemon
+
+msg 'Anonymous clone URL: git://<this-server>/%s.git' "${NAME_REPO_DIR}"
+msg 'Push updates later with: git push ssh://%s@<this-server>%s' \
+ "${USERNAME}" "${PATH_GIT_MIRROR}"
+msg 'Firewall note: git daemon listens on port 9418/tcp.'